61–70 of 82 posts
Earlier quoted context omitted.
If sudo works the same way on Mac's as it does on Linux, then anyone in the sudoers file could give a rogue application root access.
It does, and, the only user there, by default, is the first user of the system - the administrator. Not all people use this as their main user.
In the article, it mentions that the password are hashed using SHA-512. As has been mentioned before, using such a fast hashing scheme for passwords is a terrible idea. Any idea as to why they do it this way? (instead of using bcrypt)
Despite all the ranting on HN about bcrypt, pretty much no one actually uses it. Not linux, not windows, not apple.
You can also just boot your Mac in single-user mode (Command-S), then mount the main filesystem and type "passwd bob". Much easier and produces the same effect.
Unless the Mac has a firmware password. You could just remove that by resetting the PRAM, unless you wanted to go undetected. In that case, you could remove the hard drive, mount it elsewhere, and change the password hash. Is FileVault plus a firmware password the only safe way to keep your Mac?
(I'm pretty sure that pre-Lion's FileVault is in the same case, where you'll still need the user's old password to decrypt their home directory's encrypted dmg, but I'm not 100% certain.)
Earlier quoted context omitted.
Apple doesn't compensate security researchers, so I am not disappointed or surprised. In fact, they just ignore people half the time. If it was a bug in a Google product, you can bet that he would have coordinated his disclosure with a fix.
Compensation is irrelevant - if you bothered to sniff around a specific vendor's security and you discover an exploit then you really should disclose it. Such is the lore of white-hatism. Sure many don't do the above, but the OP author is presenting himself as white-hat/legitimate. And as informed users, we should consider carefully giving our business to vendors who don't go out of their way to encourage private dis…
Although there are various opinions on the best way to disclose bugs, your view of what it means to be "whitehat/legitimate" is not actually consistent with the infosec industry, so please do not misuse the terms to throw judgments at others.
We can easily spin it the other way too after all - one could say that the largest, most profitable company in the world has a moral obligation to compensate those that are protecting their users where they failed to.
For reference: http://www.digitalbond.com/about-us/vulnerability-disclosure... http://erratasec.blogspot.com/2011/09/finally-responsible-di... http://www.securityfocus.com/brief/933 http://trailofbits.com/2009/03/22/no-more-free-bugs/
Earlier quoted context omitted.
Full disclosure is the only responsible sort of disclosure. Apple, like Microsoft, has the tendency to sweep things under the rug when they feel it is unlikely the situation will become public. The only way to correct this behavior is release what you find to the public and as fast as possible.
Hmmm, surely 'Responsible Disclosure'[1] is the only responsible sort of disclosure - so named because it is, er, responsible. [1] - http://en.wikipedia.org/wiki/Responsible_disclosure TL:DR of above link: "[responsible disclosure] is like full disclosure, with the addition that all stakeholders agree to allow a period of time for the vulnerability to be patched before publishing the details"
I've pasted some other definitions of "responsible disclosure" in a different reply.
1. When it comes to security, from the point of view of an OS vendor, if you have gained unauthorized access to an interactive shell on a target machine it's already "game over, man". You cannot protect against physical access, and you can pretty much assume that there are a plethora of unknown privilege escalation bugs so that any account is effectively a root account. Every company has limited security resources, and at some point there are trade-offs between usability and security. This is why efforts are typically focused on keeping the baddies out.
Once the bad guy gets in, you can only mitigate potential harm. This is the goal of things like File Vault (which will still protect your stollen laptop, assuming you put on a screensaver password). This is also why merely being able to change a password is not nearly as bad as...
2. Being able to recover the plain text of a user's password. I'm not going to discuss how or why, but this was possible on earlier versions of OS X and fixed only in Lion. In this regard, "cracking" passwords is much harder on Lion than it was on Snow Leopard and earlier.
Of course, that sort of level-headed approach to this kind of topic seems to be rarer and rarer on HN these days...unfortunately...
Earlier quoted context omitted.
Full disclosure is the only responsible sort of disclosure. Apple, like Microsoft, has the tendency to sweep things under the rug when they feel it is unlikely the situation will become public. The only way to correct this behavior is release what you find to the public and as fast as possible.
Hmmm, surely 'Responsible Disclosure'[1] is the only responsible sort of disclosure - so named because it is, er, responsible. [1] - http://en.wikipedia.org/wiki/Responsible_disclosure TL:DR of above link: "[responsible disclosure] is like full disclosure, with the addition that all stakeholders agree to allow a period of time for the vulnerability to be patched before publishing the details"
I can call myself a shark. That doesn't make it so.
Two points: 1. When it comes to security, from the point of view of an OS vendor, if you have gained unauthorized access to an interactive shell on a target machine it's already "game over, man". You cannot protect against physical access, and you can pretty much assume that there are a plethora of unknown privilege escalation bugs so that any account is effectively a root account. Every company has limited security…
I'm no security expert, but that doesn't seem right to me.
You can also just boot your Mac in single-user mode (Command-S), then mount the main filesystem and type "passwd bob". Much easier and produces the same effect.
That risk level is not at all on par with this though. That won't help with filevault turned on, and it requires both a reboot and a physical presence at the machine. This can be done remotely with shell access, and discloses hashes from other accounts.